Community Trust ScoreVerified
Bitcoin theft tied to Coldcard hardware wallets has crossed $100 million. Galaxy Research put the confirmed total at 1,596 BTC stolen from roughly 7,300 addresses, spread across three major attack waves and 14 smaller incidents.
The numbers keep climbing. Galaxy’s earlier estimate had tracked 1,367 BTC across 4,585 addresses — already a staggering figure. But fresh victim confirmations pushed that count up sharply, and the research team now says 73 victims have verified involvement in the three main waves. Beyond those, smaller opportunistic attacks also hit wallets carrying the same vulnerability, suggesting that once word got out in certain circles, multiple bad actors moved to exploit it. Galaxy’s update made clear that these aren’t isolated incidents — there’s a pattern here, and it’s probably not finished.
73 confirmed victims. And possibly more coming.
A Suspected Fourth Wave Could Push Losses to $130M
Galaxy is fairly confident a fourth wave exists. If confirmed, it would add another 459 BTC to the pile, bringing the grand total to 2,055 BTC — worth around $130 million at current prices. But the firm hasn’t folded that into the official tally yet. Victim verification is still pending, and without direct confirmation from those affected, Galaxy is keeping it out of the confirmed estimate. That’s a careful call, and probably the right one. It’s hard to build a credible case for law enforcement if the numbers keep shifting without solid backing.
So the official figure stays at 1,596 BTC for now. But $130 million isn’t far off if the fourth wave checks out.
What’s strange — and honestly a little unsettling — is that 90% of the stolen Bitcoin hasn’t moved. It’s just sitting there. For investigators, that cuts both ways. On one hand, static funds are easier to track and potentially intercept at exchanges if the attacker tries to cash out. On the other hand, it might mean the people behind this are patient. Very patient. They could be waiting for scrutiny to die down, or deliberately holding off to avoid triggering blockchain analytics tools that flag sudden large transfers. Either way, the inactivity gives law enforcement a window — but that window won’t stay open forever.
Galaxy Coordinates With Law Enforcement and Exchanges
Galaxy Research has been sharing compromised address data with US federal law enforcement, crypto exchanges, and cyber-investigation firms. That’s pretty much standard procedure at this scale, but the coordination matters. Exchanges that receive flagged addresses can freeze funds the moment a withdrawal attempt hits their platform. It’s not a guaranteed fix — experienced attackers use mixers, cross-chain bridges, or peer-to-peer channels to sidestep exchange controls — but it raises the cost of cashing out significantly.
The firm has also been working directly with victims to gather more granular details. That victim outreach has been crucial. The smaller, opportunistic attacks — the 14 incidents beyond the three main waves — were only identified because Galaxy kept digging. Those smaller hits might involve different actors entirely, people who caught wind of the vulnerability and moved fast on a smaller scale. Piecing together that picture requires victims to come forward, and not all of them do.
Galaxy’s warning to Coldcard users is blunt: move your Bitcoin now. The attacks are still ongoing, per the research team’s own words. Sitting on a potentially compromised wallet while investigators sort out the full scope is a bad bet. Hardware wallets have long been seen as the gold standard for self-custody security, and breaches at this scale shake that reputation hard. It’s not clear yet exactly what vulnerability is being exploited — the source didn’t specify the technical mechanism — but the scale of addresses affected, 7,300 and counting, means the exposure is broad.
For the broader crypto security world, the Coldcard situation is a reminder that cold storage isn’t automatically safe. The assumption that keeping Bitcoin offline removes all risk has always been a simplification. Physical device vulnerabilities, seed phrase exposure, and supply chain attacks have all surfaced over the years. This one seems different in scope, though. Seven thousand addresses across multiple coordinated waves points to something more systematic than a one-off compromise.
Galaxy Digital’s research arm continues to monitor the situation. The fourth wave, if it clears verification, would make this one of the largest hardware wallet thefts on record. For now, 1,596 BTC confirmed stolen, 90% unmoved, and the attackers still unidentified.
Frequently Asked Questions
How much Bitcoin was confirmed stolen from Coldcard wallets?
Galaxy Research confirmed 1,596 BTC stolen from approximately 7,300 addresses across three major attack waves and 14 smaller incidents, with total confirmed losses exceeding $100 million.
What is the suspected fourth wave of Coldcard attacks?
Galaxy Research believes a fourth wave exists that would add 459 BTC to the total, potentially bringing losses to 2,055 BTC or around $130 million, but victim confirmation is still pending and it remains outside the official count.
